Researchers say hackers used PHP2Shell and a Linux kernel exploit to compromise 25 servers, including three linked to an apparent US government organisation, as evidence mounts of attacks worldwide.
Cybersecurity firm Dream Research reported on October 26 that attackers combined two critical PHP flaws with Fragnesia (CVE-2026-46300), a Linux kernel vulnerability, to gain root-level access without login credentials.
The attackers identified approximately 19,000 internet-facing firewalls and selected 240 targets across the United States, Japan, Taiwan and South Korea. Dream says 24 firewalls were compromised, with 22 left carrying root-level web shells that could enable further access. The targeted devices used PHP 8.0.30, a version no longer supported by the PHP project.
Two compromised firewalls appeared associated with a US government organisation. Attackers used one to establish a persistent connection into its internal network and compromise a central firewall management server, bringing Dream's reported total to 25.
According to Dream, attackers decrypted an Active Directory service-account password and mapped the organisation's users and groups. Whether attempts to compromise additional accounts or create backdoors succeeded is unknown. Dream did not identify the victim or firewall vendor, and the government-linked intrusion has not been independently confirmed.
Dream suspects a China-linked operation, citing the countries targeted and Chinese-language activity. Investigators also found software configured with DeepSeek and Kimi, but could not establish that AI produced the exploits or that Beijing directed the attack.
Independent researchers have confirmed PHP2Shell code execution on deliberately vulnerable test servers. On October 24, Adel Karimi recorded 35 shell launches across three honeypots. On October 28, Previdian observed commands executing on four more. Neither investigation established additional production-server compromises.
Delft University of Technology recorded more than 73,000 PHP2Shell-related requests from 668 source IP addresses across 73 countries by October 29. Researchers identified attempted downloads of Mirai-derived botnet malware and a backdoor, but not confirmed infections.
The US Cybersecurity and Infrastructure Security Agency (CISA) added both PHP2Shell vulnerabilities to its list of known exploited flaws on October 26 and Fragnesia on October 28. Palo Alto Networks separately confirmed attacks on internet-exposed firewall management interfaces, although it remains unclear whether these are connected to Dream's investigation.
PHP released emergency security patches on October 21. Administrators should update affected software, restrict management-interface access and investigate earlier intrusions, as patching cannot remove existing backdoors.
